Tor Browser – A Brief Overview The Tor Internet Browser is an Internet browsing application that uses The Onion Router (Tor) network that consists of a number of computer servers that move data from one to the next, making it difficult to identify the source of that data and trace it. ‘Tor’ is also a […]
Internet Browsing Forensics – The Provenance of an Image on a Computer
Internet Browsing Forensics – Identifying the Specific Source of an Image On a computer or mobile phone Internet websites are normally ‘visited’ using Internet Browsing software when the browser is directed to the required website. The Internet Browsing software is directed to the required website by using a website address or Uniform Resource Locator (URL). […]
Windows File Time/Date Stamps Explained
How Time/Date Stamps can Assist in Proving the Provenance of a File An operating system normally maintains information about a file that includes a time/date stamp. The time/date stamp can record the point that a file had been created, altered and accessed and is generated by the computer’s system clock. By investigating the time/date stamp […]
Master File Table (MFT)
What is the Master File Table? When files are stored on a Windows computer using the NTFS file system, such as images or documents, physical clusters are allocated to the file and the location of the clusters containing the file are recorded within the Master File Table (MFT) that is maintained by the operating system. […]
Thumbcache Images
Thumbcache Images – An Overview Thumbcache files are database files that are automatically generated by the Microsoft Windows operating system from Windows Vista onwards within the ‘hidden’ system directory located at the path \Users\[User Profile Name]\AppData\Local\Microsoft\Windows\Explorer\. How are Thumbcache Images Stored? Images within the Thumbcache files are automatically stored when a folder on the computer […]
